Arcade Mcp
Approved changes feed: RSS · Atom
cpe:2.3:a:arcadeai:arcade-mcp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Arcadeai (09d0e924-62fb-5dd9-952c-f833b5cf326a) |
|---|---|
| Product | Arcade Mcp (39be4e18-68ec-5045-8591-47c289f87d8e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66454 |
vulnerable | 2026-06-08 07:41:18.977363 |
Arcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints
MEDIUM (6.5)
Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This grants remote access to all worker endpoints—including tool enumeration and tool invocation—without credentials. This vulnerability is fixed in 1.5.4.
Published: 2025-12-02T18:23:33.377Z
Updated: 2025-12-02T19:28:27.762Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.